First version

files/time/time_from_contest.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=Set the clock from the contest site if NTP does not work
+After=firewall.service chrony.service
+
+[Service]
+Type=oneshot
+ExecStart=/time_from_contest.sh

files/time/time_from_contest.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Fallback for the clock. If chrony has no time server after two minutes of
+# uptime (for instance when the campus network blocks NTP), the clock is set
+# from the Date header of the contest site, which is accurate to the second.
+CONF=/etc/contest-firewall
+[ "$(cut -d. -f1 /proc/uptime)" -ge 120 ] || exit 0
+if chronyc -n sources 2>/dev/null | grep -qE '^\^\*'; then
+    exit 0
+fi
+site=$(sed -e 's/#.*//' -e 's/[[:space:]]//g' "$CONF/allowed_domains.txt" | grep -m1 .)
+# -k: certificates cannot be checked while the clock is far off
+date_header=$(curl -skI --max-time 10 "https://$site/" | tr -d '\r' | sed -n 's/^[Dd]ate: //p')
+[ -n "$date_header" ] || { logger -t time_from_contest "no answer from $site"; exit 1; }
+server=$(date -d "$date_header" +%s) || exit 1
+now=$(date +%s)
+offset=$((server - now))
+if [ "${offset#-}" -ge 2 ]; then
+    # The header has whole seconds: aim for the middle of the second
+    date -s "@$server.5" >/dev/null
+    logger -t time_from_contest "chrony has no time server; clock set from $site (was off by $offset s)"
+fi

files/time/time_from_contest.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Check every minute that the clock has a time source
+
+[Timer]
+OnBootSec=2min
+OnUnitActiveSec=1min
+
+[Install]
+WantedBy=timers.target